Trigger federation reconciliation

POST

/api/v1/federation/group-mappings/sync

const url = 'http://localhost:3000/api/v1/federation/group-mappings/sync';
const options = {method: 'POST', headers: {'X-API-Key': '<X-API-Key>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:3000/api/v1/federation/group-mappings/sync \
  --header 'X-API-Key: <X-API-Key>'

Runs a full reconciliation of federated memberships against the last-known Entra attributes stored in Keycloak, applying the currently-configured group mappings. Does NOT poll Entra (login remains authoritative for the cloud OIDC path). Returns aggregated counts. Requires Super Admin privileges.

Authorizations

api-key
bearer

Parameters

Header Parameters

x-organization-id

string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Responses

200

Reconciliation completed

application/json

object

usersProcessed

required

Number of brokered Keycloak users mapped to a logiccloud orchestrate user and reconciled

number

added

required

Total FEDERATED memberships created

number

updated

required

Total memberships whose role changed

number

removed

required

Total FEDERATED memberships removed

number

skipped

required

Number of Keycloak users skipped (no WFM user, no Entra attributes, or a per-user error)

number

Example

{
  "usersProcessed": 42,
  "added": 3,
  "updated": 1,
  "removed": 2,
  "skipped": 5
}

401

Unauthorized

403

Forbidden - Super Admin required